74ce21c5c0d1ab7a1c30b06f40bc5079b80dfc6ffcc8bbcaa8ceefb6e4d7d0aa

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 16:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260424-tjljfsey2n
SHA256 74ce21c5c0d1ab7a1c30b06f40bc5079b80dfc6ffcc8bbcaa8ceefb6e4d7d0aa
MD5 41bc003192edad9ec8283daed3a6f57d
SHA1 aa0a6064eedd7df55c4eb878d037aaed4fb7015d
SHA512 756f17da8b7e7fa20a329b1468483f44d9ea36bcaf29135b123d5fcfb1c9422c1ef01bbbb173e2e37094347b2ab441e7145e0bb702ea0c4355ab81a116299bcf
SSDEEP 12288:qO4rfItL8HGfJOeSFMrwgfAMOnIXK9z1sg+SB7bWmeEVGL:qO4rQtGGvSFMrwiANUOsg+KumeEVGL
TLSH
T191A4F1397281C133E59302711BDBDBAAAA3E79B44726A4C337D4427D1E616E1D33A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3388	4F05.tmp

Executes dropped EXE 1 IoCs

pid	Process
3388	4F05.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4F05.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3388	3480	2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\4F05.tmp
  "C:\Users\Admin\AppData\Local\Temp\4F05.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe 8918715E38975393B4523597272388E68F30BAACF86ED32EDA66687BA2AE5751A6352BB5794EB3BAEB6C1AE783F50FF5D05B58442BED87046903221055176DE2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4F05.tmp

Path C:\Users\Admin\AppData\Local\Temp\4F05.tmp
Size 468KB
SHA256 936f7fe0eb7e5c49a3a32b8aa099f1b1e0e7c0efe89f285d1eadc912855dd84e
MD5 984239b0cf8b1fbd8e5a5c49b21d6cad
SHA1 5cb3d88f51ae9a11f4e76e998df4a4dfaa43cbb0
SHA512 74f973ac967764c4d4e3b1f3c9ce2fba2b001a8be453856f8196a495149a2b4545ac6ea6348e889edb75ee77da17e4cdde927b29e174293ab066d3d2a35c7c7b
SSDEEP 12288:qO4rfItL8HGfU720e5hHE9tMB1tntnSs7bWmeEVGL:qO4rQtGGs7Le3HgtMB/ntnBumeEVGL
TLSH
T119A4F12AB641C033D29302711BE6D7AAA73E35B50726A4C33BD8467D2F616E1D73A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3480-4-0x0000000001500000-0x0000000001519000-memory.dmp

Download